cryptocurrency-platform-risksearch-ad-manipulationidentity-impersonation-fraudremote-access-implant

Trojanized WhatsApp and Telegram Apps Target Cryptocurrency Wallets

Emerging Technology Risk · 3 sources · Updated 4mo ago · First seen Mar 16, 2023

ESET researchers uncovered dozens of fake WhatsApp and Telegram websites distributing trojanized Android and Windows installers aimed largely at Chinese-speaking users trying to access blocked messaging services outside official app stores. The malicious Android apps included the first observed clipper malware embedded in instant messaging clients, replacing cryptocurrency wallet addresses in chats so funds would be redirected to attacker-controlled accounts. Some samples also used OCR to scan screenshots and photos for wallet recovery phrases, while other variants exfiltrated messages, Telegram data, device details, and files.

On Windows, the campaign delivered both Telegram clippers and bundled remote access trojans (RATs) that enabled keylogging, clipboard theft, screen capture, and file operations. Victims were lured through Google Ads, fraudulent YouTube channels, and counterfeit download pages impersonating legitimate messaging services. ESET said the operation reflects a broader cryptocurrency-theft ecosystem built around fake messaging apps and reported the malicious ads and channels to Google, which removed them.

New surface, new adversariesTrack how attackers are adapting to this technology.

Track this risk

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Mar 16, 2023

Mar 16, 20234y ago
Google removes malicious ads and YouTube channels reported by ESET
After ESET reported the campaign's malicious Google Ads and fraudulent YouTube channels to Google, the company removed them. This action disrupted part of the distribution infrastructure used to lure victims to counterfeit download sites.
Not-so-private messaging: Trojanized WhatsApp and Telegram apps go after cryptocurrency wallets
Mar 16, 20234y ago
ESET finds Windows trojanized messaging apps with clipper and RAT features
ESET found Windows-based fake Telegram and WhatsApp installers containing clippers that alter cryptocurrency wallet addresses in messages as well as bundled remote access trojans. The RAT functionality included keylogging, clipboard theft, screen capture, and file operations.
Not-so-private messaging: Trojanized WhatsApp and Telegram apps go after cryptocurrency wallets
Mar 16, 20234y ago
ESET documents Android messaging-app clippers and data-theft clusters
ESET reported Android malware embedded in fake messaging apps, including the first observed clippers in instant messaging apps that replace cryptocurrency wallet addresses in chats. Some samples also used OCR to scan screenshots and photos for wallet recovery phrases, and ESET grouped the threats into four Android clusters with varying theft capabilities.
Not-so-private messaging: Trojanized WhatsApp and Telegram apps go after cryptocurrency wallets
Mar 16, 20234y ago
ESET identifies trojanized Telegram and WhatsApp distribution campaign
ESET researchers identified dozens of fake Telegram and WhatsApp websites distributing trojanized Android and Windows apps, primarily targeting Chinese-speaking users seeking blocked services outside official channels. The campaign used Google Ads, fraudulent YouTube channels, and counterfeit download sites to lure victims.
Not-so-private messaging: Trojanized WhatsApp and Telegram apps go after cryptocurrency wallets

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Affected products

2 linked

TelegramWhatsapp

Organizations

2 linked

Meta PlatformsTelegram

Observables

75 linked

SHA-1 hash••••••••••••••••••••••••••••••••••••••••Domain•••••••.ruIPv4 address•••.••.•••.•••SHA-1 hash••••••••••••••••••••••••••••••••••••••••Domain••••••••••.comIPv4 address•••.•••.••.•••SHA-1 hash••••••••••••••••••••••••••••••••••••••••Domain••••••.ru+67

Indicator values are masked on this page. View all 75 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Follow how adversaries are adapting to this technology, and where it touches your stack today.

Track This Risk

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Eset Welivesecurity BlogNews · Mar 16, 2023

Not-so-private messaging: Trojanized WhatsApp and Telegram apps go after cryptocurrency walletsOpen source ↗

Mitre AttackNews

Application Layer Protocol: Web Protocols, Sub-technique T1071.001 - Enterprise | MITRE ATT&CK®Open source ↗

Mitre AttackNews

Exfiltration Over C2 Channel, Technique T1041 - Enterprise | MITRE ATT&CK®Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News